I am very thankful for this explanation. Your channel allows me to get really helpful coding knowledges and also to improve my English!!!

How does this prevent the hacker from performing CSRF? The hacker can just read the XSRF-TOKEN Cookie from the client side code and add it as a header? Would love to get some clarity.

@shyamsundargoyal9251

2 жыл бұрын

I think if you are saving this token in cookie then it should be like session ids. A unique token for every logged in user

@chessking3248

Жыл бұрын

I have the same question

MY BROTHER!! Thank you so much ! I’m bad in English, but I excellent understand you. Respect! DjazakAllah hayran

It was very helpful to me. Thanks man for explaining this concept in detailed

extremely well explained and enlightening, thank you very much!!!

I not completely understood. If CSRF token is saved in cookies the user browser will send cookies at intruder's link opening. Looks like sending CSRF token in some hidden form field is much better.

@shyamsundargoyal9251

2 жыл бұрын

You can make that cookie's samesite flag as strict. So it won't be sent on cross site requests

@chessking3248

Жыл бұрын

@@shyamsundargoyal9251 The final request in a CSRF attack is not cross-site .

Very well explained. Thanks

Well explained.

Hi, is it possible to run off the csrf "Are you sure you want to logout" screen in spring boot security for a non logged in users? By default it shows even if a user did not log in.

Great video ! Thanks a lot

Thank you very much, I was sicking for that really

Hello...Is it possible to enable CSRF and HttpOnly/Secure(for JseesionId) in the same time?

Amigo can u please help em solve dissapering csrf in react application using spring boot

Superb! Well explained!

csrf token every time change per post request how to handle in angular

when i get csrf token from backend it is not set in cookie automaticaly

How this prevent someone from impersonating by using the same csrf token?

@StyleTrick

3 жыл бұрын

Yes, the hacker could write code to simple get the XSRF-TOKEN from the cookies on the client side?

@shyamsundargoyal9251

2 жыл бұрын

@@StyleTrick the cookie that you are sending should have samesite flag as strict. So it cannot be sent with cross site requests. Also to avoid xss, cookie should be httpsecure so that client side js cannot access it.

@ilyaslyusarchuk3664

2 жыл бұрын

@@shyamsundargoyal9251 so how does it work from postman (copying the CSRF token) and not from a malicious website?

Is it expected that the XSRF token changes on every call? I have implemented but any call will retrieve a different token

If it wasn't too much trouble, is the example repository available?

my spring do not creat the scrf token, i have no cookies :(( help

I understand how CSRF attack works,but, why the cookie protects the server? The attacker cannot copy that CSRF token inside the cookie? If you have the client token and the user token, you have all, no?

@cse8617

2 ай бұрын

Browser is smart enough to only allow a website to access its own cookie, now website can access the cookie of other website

Sir, If I'm using angular as frontend and rest API in spring boot with security at the backend and I'm not using cookies anywhere in the entire application, I'm using localStorage. Does it make sense to use CSRF and if yes then how when I'm not using cookies? Eagerly waiting for your reply!

@kishoreramana1

2 жыл бұрын

best way is sending the token in the hidden field. [...]

@shyamsundargoyal9251

2 жыл бұрын

@@kishoreramana1 I think for this to work you need to send a changing token every time because if a hacker is targeting a particular site he can use the value of this csrf token if it is same always.

@kishoreramana1

2 жыл бұрын

@@shyamsundargoyal9251 we would need to generate a new csrf token whenever user logs in or refreshes the session, then it would be unique for that session.

I'm not getting any cookie when sending get request?

Is the csrf token is changing every requests or remain the same?

I HATE FUCKING GAMESTOP KEEP SAYING IM TRYING TO DO THIS

which course is this a part of? youtube is not linking the previous episode

@EgorlandiaxTsar

2 жыл бұрын

Hello! Here is the link (SpringBootSecurity) kzread.info/dash/bejne/mpmmwZmpkZPcoso.html

Where is the full code/github link for this ?

Wheres the git?

Thank you.

Can you provide source code for this video

hallo amigoscode , if i want to start learn java programming can you share tutorial link for beginner ^_^ , Thank you ...

@amigoscode

4 жыл бұрын

planning to record a course

I have a question ... I already have the knowledge on IDOR, CSRF vulnerabilities but I need to practice .. like chess ... I am happy there are softwares I can practice on relating to chess ... because I can test out ..reaarange..apply...try out anything I have learnt ... so saying that .. are there any websites or softwares I can buy that has like 100's of IDOR vulnerabilities that I can use Burp on and practice all night?? Thanks.

@amigoscode

4 жыл бұрын

not sure I am afraid

@gindudheer5539

4 жыл бұрын

Yes, OWASP has a few vulnerable by design websites for you to practice on. Check it out

If we are using jwt do we need csrf enabling?

@cse8617

2 ай бұрын

No

hey im not getting all those cookies that your getting all im getting is a jsessionid how do i get what your getting

@amigoscode

4 жыл бұрын

Full course is now out. Check my channel for the latest video

@truth-seeker-2300

4 жыл бұрын

Hi Justin, if you have figured out how to get that csrf token while sending a GET request, sharing the workout is highly appreciated :)

great

sir can you give one cousre about BDA postgresql

@amigoscode

4 жыл бұрын

on my TODOs

what version of postman are you using my ui looks different from yours

@amigoscode

4 жыл бұрын

Justin Davis I was using a deprecated version. But the new one is quite similar

@justindavis7654

4 жыл бұрын

@@amigoscode do you do any front end ui stuff with angular?

@amigoscode

4 жыл бұрын

Justin Davis no angular so just react 🙂

I JUST WANT A FUCKING CONTROLLER AND I DONT HAVE MY CREDIT CARD ON ME SO IM DOING IT ONLINE

amazing your channel

@amigoscode

4 жыл бұрын

Thanks. Subscribe for more